In reply to @balsoft:balsoft.ru
nix cli 2 is the experimental nix-command feature, I suppose

In reply to @balsoft:balsoft.ru

{ config, pkgs, lib, inputs, ... }: {
  vault-secrets.secrets.update-daemon = {
    secretsAreBase64 = true;
  };

  services.update-daemon = {
    enable = true;
    secretFile = "${config.vault-secrets.secrets.update-daemon}/environment";
    agentSetup = ''
      export PATH="$PATH":${lib.makeBinPath [ pkgs.openssh ]}
      if [[ -z "''${SSH_AGENT_PID:-}" ]] ; then
        echo "Starting an ephemeral ssh-agent" >&2;
        eval "$(ssh-agent -s)"
      fi
      cat ${config.vault-secrets.secrets.update-daemon}/private_ssh_key | env SSH_ASKPASS="$(command -v false)" ssh-add -
    '';
    repos = {
      github = {
        serokell = {
          gemini-infra = {};
          pegasus-infra = {};
        };
      };
    };
    settings = {
      author.email = "operations@serokell.io";
      extra_body = "CC @serokell/operations";
    };
  };
}

In reply to @aciceri:nixos.dev
What you mean with noisy?

If I understand correctly, the bot pushes to a branch called automatic-update in the same repository, I suppose I have to create it before, right?
And the ssh key must be that of the bot user on Github (I've to give it the write permissions in the automatic-update branch). However could I use also my ssh key specifying a custom author.name? In this case giving permissions wouldn't be necessary since I would have a single GIthub account.

However I understand the problem you exposed, I hope you solve it soon, it's a nice project that could be used by many since the increment of people passing to Flake.

In reply to @aciceri:nixos.dev

If I understand correctly, the bot pushes to a branch called automatic-update in the same repository, I suppose I have to create it before, right?
And the ssh key must be that of the bot user on Github (I've to give it the write permissions in the automatic-update branch). However could I use also my ssh key specifying a custom author.name? In this case giving permissions wouldn't be necessary since I would have a single GIthub account.

However I understand the problem you exposed, I hope you solve it soon, it's a nice project that could be used by many since the increment of people passing to Flake.

1. The bot will automatically create the update branch if it doesn't exist
2. Yes, the ssh key must have push permission to the repository. You can use author.name but that would only affect commits, not the github interface (e.g. the pull requests will still show you as the initiator)

In case any of the flakes fail to update, update-daemon will exit with a non-zero exit code (but still finish updating all the other flakes);

But what does this (from README) mean?
It fails only if the strings replacement in flake.lock fails or is it also running tests/checks?

In reply to @aciceri:nixos.dev

In case any of the flakes fail to update, update-daemon will exit with a non-zero exit code (but still finish updating all the other flakes);

But what does this (from README) mean?
It fails only if the strings replacement in flake.lock fails or is it also running tests/checks?